{"id":13566848,"url":"https://github.com/xepor/xepor","last_synced_at":"2025-04-04T00:32:22.788Z","repository":{"id":47766737,"uuid":"376069138","full_name":"xepor/xepor","owner":"xepor","description":"Xepor, a web routing framework for reverse engineers and security researchers, brings the best of mitmproxy \u0026 Flask","archived":false,"fork":false,"pushed_at":"2025-03-29T01:53:42.000Z","size":82,"stargazers_count":208,"open_issues_count":5,"forks_count":21,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-29T02:25:40.326Z","etag":null,"topics":["hacktoberfest","http","mitm","mitmproxy","mitmproxy-addons","python","reverse-engineering","security"],"latest_commit_sha":null,"homepage":"https://xepor.readthedocs.io/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/xepor.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.rst","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":"AUTHORS.md","dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-06-11T15:32:46.000Z","updated_at":"2025-03-29T01:53:45.000Z","dependencies_parsed_at":"2025-03-29T02:24:04.337Z","dependency_job_id":"a1ab2e02-353f-46e1-ab4d-1e752ecd203d","html_url":"https://github.com/xepor/xepor","commit_stats":{"total_commits":48,"total_committers":2,"mean_commits":24.0,"dds":"0.10416666666666663","last_synced_commit":"e4eea4983742e360e2571a4f3f34c6efc1dfb785"},"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xepor%2Fxepor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xepor%2Fxepor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xepor%2Fxepor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xepor%2Fxepor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/xepor","download_url":"https://codeload.github.com/xepor/xepor/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247103290,"owners_count":20884023,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hacktoberfest","http","mitm","mitmproxy","mitmproxy-addons","python","reverse-engineering","security"],"created_at":"2024-08-01T13:02:17.967Z","updated_at":"2025-04-04T00:32:22.448Z","avatar_url":"https://github.com/xepor.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"[![Unit Tests](https://github.com/xepor/xepor/actions/workflows/test.yml/badge.svg)](https://github.com/xepor/xepor/actions/workflows/test.yml)\n[![PyPI-Server](https://img.shields.io/pypi/v/xepor.svg)](https://pypi.org/project/xepor/)\n![PyPI - Status](https://img.shields.io/pypi/status/xepor)\n[![Documentation Status](https://readthedocs.org/projects/xepor/badge/?version=latest)](https://xepor.readthedocs.io/en/latest/?badge=latest)\n[![Project generated with PyScaffold](https://img.shields.io/badge/-PyScaffold-005CA0?logo=pyscaffold)](https://pyscaffold.org/)\n[![996.icu](https://img.shields.io/badge/link-996.icu-red.svg)](https://996.icu)\n\n# Xepor\n\n[Xepor](https://github.com/xepor/xepor) (pronounced */ˈzɛfə/*, zephyr) is a web routing framework for reverse engineers and security researchers.\nIt provides a Flask-like API for hackers to intercept and modify HTTP requests and/or HTTP responses in a human-friendly coding style.\n\nThis project is meant to be used with [mitmproxy](https://github.com/mitmproxy/mitmproxy/). Users write scripts with `xepor`, and run the script *inside* mitmproxy with `mitmproxy -s your-script.py`.\n\nIf you want to step from PoC to production, from demo(e.g. [http-reply-from-proxy.py](https://github.com/mitmproxy/mitmproxy/blob/v7.0.4/examples/addons/http-reply-from-proxy.py), [http-trailers.py](https://github.com/mitmproxy/mitmproxy/blob/v7.0.4/examples/addons/http-trailers.py), [http-stream-modify.py](https://github.com/mitmproxy/mitmproxy/blob/v7.0.4/examples/addons/http-stream-modify.py)) to something you could take out with your WiFi Pineapple, then Xepor is for you!\n\n## Features\n\n1. Code everything with `@api.route()`, just like Flask! Write everything in *one* script and no `if..else` any more.\n2. Handle multiple URL routes, even multiple hosts in one `InterceptedAPI` instance.\n3. For each route, you can choose to modify the request *before* connecting to server (or even return a fake response without connection to upstream), or modify the response *before* forwarding to user.\n4. Blacklist mode or whitelist mode. Only allow URL endpoints defined in scripts to connect to upstream, blocking everything else (in specific domains) with HTTP 404. Suitable for transparent proxying.\n5. Human readable URL path definition and matching powered by [parse](https://pypi.org/project/parse/)\n6. Host remapping. define rules to redirect to genuine upstream from your fake hosts. Regex matching is supported. **Best for SSL stripping and server-side license cracking**!\n7. Plus all the bests from [mitmproxy](https://github.com/mitmproxy/mitmproxy/)! **ALL** operation modes ( `mitmproxy` / `mitmweb` + `regular` / `transparent`  / `socks5` / `reverse:SPEC` / `upstream:SPEC`) are fully supported.\n\n## Use Case\n\n1. Evil AP and phishing through MITM.\n2. Sniffing traffic from target device by iptables + transparent proxy, modify the payload with xepor on the fly.\n3. Cracking cloud-based software license. See [examples/krisp/](https://github.com/xepor/xepor-examples/tree/main/krisp/) as an example.\n4. Write a complicated web crawler in **\\~100 lines of code**. See [examples/polyv_scrapper/](https://github.com/xepor/xepor-examples/tree/main/polyv_scrapper/) as an example.\n5. ... and many more.\n\nSSL stripping is NOT provided by this project.\n\n# Installation\n\n```bash\npip install xepor\n```\n\n# Quick start\n\nTake the script from [examples/httpbin](https://github.com/xepor/xepor-examples/tree/main/httpbin/) as an example.\n\n```bash\nmitmweb -s example/httpbin/httpbin.py\n```\n\nSet your Browser HTTP Proxy to `http://127.0.0.1:8080`, and access the web interface at http://127.0.0.1:8081/.\n\nSend a GET request from http://httpbin.org/#/HTTP_Methods/get_get , Then you could see the modification made by Xepor in mitmweb interface, browser dev tools or Wireshark.\n\nThe `httpbin.py` do two things.\n\n1. When user access http://httpbin.org/get, inject a query string parameter `payload=evil_param` inside HTTP request.\n2. When user access http://httpbin.org/basic-auth/xx/xx/ (we just pretend we don't know the password), sniff `Authorization` headers from HTTP requests and print the password to the attacker.\n\nJust what mitmproxy always does, but with code written in [*xepor*](https://github.com/xepor/xepor) way.\n\n```python\n# https://github.com/xepor/xepor-examples/tree/main/httpbin/httpbin.py\nfrom mitmproxy.http import HTTPFlow\nfrom xepor import InterceptedAPI, RouteType\n\n\nHOST_HTTPBIN = \"httpbin.org\"\n\napi = InterceptedAPI(HOST_HTTPBIN)\n\n\n@api.route(\"/get\")\ndef change_your_request(flow: HTTPFlow):\n    \"\"\"\n    Modify URL query param.\n    Test at:\n    http://httpbin.org/#/HTTP_Methods/get_get\n    \"\"\"\n    flow.request.query[\"payload\"] = \"evil_param\"\n\n\n@api.route(\"/basic-auth/{usr}/{pwd}\", rtype=RouteType.RESPONSE)\ndef capture_auth(flow: HTTPFlow, usr=None, pwd=None):\n    \"\"\"\n    Sniffing password.\n    Test at:\n    http://httpbin.org/#/Auth/get_basic_auth__user___passwd_\n    \"\"\"\n    print(\n        f\"auth @ {usr} + {pwd}:\",\n        f\"Captured {'successful' if flow.response.status_code \u003c 300 else 'unsuccessful'} login:\",\n        flow.request.headers.get(\"Authorization\", \"\"),\n    )\n\n\naddons = [api]\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fxepor%2Fxepor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fxepor%2Fxepor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fxepor%2Fxepor/lists"}